Thursday, May 22, 2014

How to find and cleanup large files in Linux

Today I received an alert a linux system was low on free space. Using the below command I found "/dev/mapper/VolGroup00-LogVol00" had 4% available space.
[root@centos ~]$ df -h
Filesystem                         Size   Used   Avail   Use% /dev/mapper/VolGroup00-LogVol00    14G    13G    548M    96%
The "VolGroup00-LogVol00" is a directory mapped as a volume used for logging. If you do not know where the logs are you can use the below command to find the large directories. You can also use a larger depth setting but the output will quickly become too much to show on the screen. As you can see below the /usr directory is 11 GB in size.
[root@centos ~]$ du -h --max-depth=1
8.0K ./mnt
541M ./lib
8.0K ./srv
52M ./etc
36M ./sbin
35M ./boot
84K ./tmp
26M ./tftpboot
0 ./proc
0 ./sys
68K ./home
0 ./misc
11G ./usr
0 ./net
241M ./var
8.0K ./media
28M ./lib64
76K ./dev
12G .
The log space consumed turned out to be logs used by a web service. The service created one log file per day and no cron jobs were setup to clear the logs. Once I determined where the logs were located I ran the below command to clear out logs files older than 100 days where part of the log names began with the word "server".
[root@centos ~]$ find /usr/local/service/logs/server* -mtime +100 -exec rm {} \;
If you find there is one long giant contiguous log instead of many individual logs you can trunk it. First you need to rename the file with the below command.
[root@centos ~]$ mv service.log service.log.old
Now, copy the last 100 lines of the log to a new log file.
[root@centos ~]$ tail -n 100 service.log.old > services.log
If you find the log was fed from the head instead of the tail you would copy the first 100 lines instead of the last 100 using the command below.
[root@centos ~]$ head -n 100 service.log.old > services.log
Next review the new log to ensure the events are recent.
[root@centos ~]$ cat service.log | less
If it looks good remove the old log.
[root@centos ~]$ rm services.log.old
Finally confirm free space has been recovered using the below command once more.
[root@centos ~]$ df -h
Filesystem                         Size   Used   Avail   Use% /dev/mapper/VolGroup00-LogVol00    14G    6.0G   7.0G    47%